Granting read access to a Teams group for reporting

[Syndicate_Admin]

Hi, this may not be the right place for the question, But my Finance director wants data on Shifts for Teams that I am leading the drive to move over to and building some companion PowerApps for. He is not a member of the team, and I was hoping to grant him Schedule.Read.All permission without making him a member or indeed an owner. My reason is I'd prefer not go hive him the ability to snoop on the Teams channels, I imagine HR would prefer that too, and I'd also prefer not to give the ability to accidently mess with the schedule if he needed to be an owner, or have him appear on the schedule data. From what I can see, my best guess so far is that I'd need the pay for a P1 / P2 licence to be able to create custom roles in Azure AD, and we'd obviously rather not do that! anyone have any thoughts? Thanks